Privacy Policy

This Privacy Policy explains what Intelligena LLC, a California limited liability company does with personal information in connection with Practiceful. It applies to the Service and not to any third-party site or service reached through it.

1. Who is responsible

Intelligena LLC, a California limited liability company is the controller (and, under California law, the “business”) for personal information processed through the Service, except where an organisation — your employer, school, practice or another Practiceful customer — uses the Service to process information about you. In that case that organisation is the controller and we act as its service provider / processor on its instructions, and you should direct your request to them; we will refer you to them and assist them in responding.

2. What we collect, where it comes from, and why

Category	Examples	Source	Why we process it
Identifiers	Name, email address, username, account ID, telephone number, IP address	You; your organisation; automatically	Creating and securing your account, authentication, support, notices
Commercial information	Plan, subscription state, purchase and refund history, invoices	You; our payment processor	Billing, fraud prevention, accounting and tax records
Payment information	Card brand, last four digits, expiry, billing postcode	Our payment processor	Taking payment. We never receive or store your full card number.
Content you provide	Files, text, images, recordings, submissions, messages and anything else you upload or create	You and your users	Providing the features you ask for, storage, and support
Usage and device data	Pages viewed, actions taken, timestamps, browser and OS, referring page, error and performance logs	Automatically	Operating, securing, debugging and improving the Service; abuse prevention
Communications	Support tickets, emails and their metadata	You	Answering you and keeping a record of what was said
Sensitive personal information	Account credentials; and, where a customer chooses to put it there, health or student information within their own content	You; your organisation	Only to provide the Service. We do not use or disclose it to infer characteristics, and we do not use it for any purpose that would trigger the right to limit its use under California law

Where consent is the lawful basis (for example non-essential cookies, or marketing email), you may withdraw it at any time. Otherwise we rely on the performance of our contract with you, our legitimate interests in operating and securing the Service, or compliance with a legal obligation.

3. The other documents this one sits beside

This Policy describes what we do with personal information. What you and Intelligena owe each other is in the Terms of Service, which govern your use of the Service and to which this Policy is incorporated. Where your use involves Protected Health Information, the Business Associate Agreement governs it and controls over this Policy in respect of that information.

These cross-references are load-bearing rather than courteous: a privacy policy that cannot reach the agreement it defers to on the handling of client or patient data is not usable for the purpose it exists for.

4. Cookies and similar technologies

See the Cookie Policy. We do not use advertising cookies or third-party trackers for advertising purposes.

5. Who we disclose personal information to

• Subprocessors and service providers — hosting, storage, email and SMS delivery, payment processing, error monitoring and AI model providers, each under contract restricting them to processing on our instructions. The current list is at Subprocessors.
• Your organisation, where you use the Service through an account it administers — it can see the content and activity within its own workspace.
• Legal and safety — where we believe in good faith that disclosure is required by law, subpoena or court order, or is necessary to investigate a breach of our terms, to protect the rights, property or safety of any person, or to prevent fraud.
• A successor, in connection with a merger, acquisition, reorganisation, financing or sale of assets, subject to this Policy continuing to apply.

6. Automated processing and AI

Some features process your content using machine-learning models, some of which are operated by us and some by third-party providers listed in our Subprocessors page. Your content is not used to train third-party foundation models, and our contracts with model providers prohibit it. We may use aggregated or de-identified data — data that does not identify you or any individual and that we do not attempt to re-identify — to evaluate and improve our own systems.

We do not make decisions producing legal or similarly significant effects about you by automated means alone. Where a feature marks, scores, flags or classifies work, the result is a recommendation to a human being, who decides.

7. How long we keep it

• Account and content: for as long as your account is open, and then for up to 90 days after closure to allow recovery.
• Billing and tax records: seven years, as accounting and tax law requires.
• Security, audit and access logs: up to 24 months.
• Backups: deleted data persists in routine encrypted backups for up to 35 days before being overwritten.
• Records of consent and of legal notices: for as long as needed to establish or defend a legal claim.

Where a customer organisation controls the data, its own retention instruction applies and may be shorter or longer than the above.

8. Security

We use reasonable administrative, technical and physical safeguards appropriate to the nature of the information, including encryption in transit and at rest, access control on a least-privilege basis, and audit logging. The specific controls we maintain, the timelines we remediate vulnerabilities to, and the attestations we have not obtained are set out in Security Practices. No method of transmission or storage is completely secure, and we cannot and do not guarantee absolute security. You are responsible for the strength and confidentiality of your own credentials. To report a suspected vulnerability, write to security@intelligena.com.

9. Your rights

Depending on where you live, you may have the right to:

• know what personal information we hold about you, and how we use and disclose it;
• receive a copy of it, in a portable format;
• correct inaccurate information;
• delete it, subject to exceptions the law allows;
• limit the use and disclosure of sensitive personal information;
• opt out of sale or sharing — we do neither, so there is nothing to opt out of; and
• not be discriminated or retaliated against for exercising any of these rights.

To exercise a right, write to privacy@intelligena.com. We will verify your identity against the information already on your account before acting, and will respond within 45 days, extending once by a further 45 days where necessary and telling you if we do. An authorised agent may act for you with written proof of authority. If we decline a request we will tell you why, and you may appeal by replying to our response; we will answer an appeal within 45 days.

10. Children

The Service is not directed to children under 13 and we do not knowingly collect their personal information. Learners under 18 reach the Service only through a school, teacher, parent or guardian who has warranted that they hold the consents the law requires. Where an educational institution uses the Service, we process student records only under that institution’s direction, as a “school official” with a legitimate educational interest under FERPA, and we do not use student data for advertising or build a profile for any purpose other than providing the Service. If you believe a child under 13 has given us information, write to privacy@intelligena.com and we will delete it.

11. Where data is processed

We are based in the United States of America and process data there. If you use the Service from elsewhere, you understand your information is transferred to and processed in the United States, where data-protection law may differ from that of your own country. Where a transfer requires a safeguard, we use the appropriate one, including the European Commission’s standard contractual clauses.

Data residency. Personal information, and every backup, archive, replica and cache of it, is physically maintained only within the United States and its territories — including where it is held by a subcontracted hosting, storage or content-delivery facility. Our Subprocessors page describes the categories involved, and Security Practices states it as a commitment. Where a Business Associate Agreement is in force it is a contractual term of that agreement, which is what Texas Senate Bill 1188 requires of an electronic health record.

12. Changes to this Policy

We review this Policy at least every twelve months and update it when our practices change. The version and effective date are shown at the top of this page. Where a change is material we will give notice by email or in the Service before it takes effect.

13. Contact and complaints

Privacy questions and requests go to privacy@intelligena.com. If you are not satisfied with our response you may complain to your data-protection authority or, in California, to the California Privacy Protection Agency or the Attorney General.